Microsoft 365 token replay campaign (Huntress, Oct 2026): AiTM phishing steals sign-in tokens, attacker replays them from 193.26.115.0/24 and registers rogue DESKTOP-XXXXXXXX Entra devices. How do I check my tenant and contain it?

What it is: Huntress reported a Microsoft 365 campaign, active from July 14 to September 22, 2026, that used adversary-in-the-middle (AiTM) phishing pages and device-code phishing to capture sign-in sessions, then replayed the stolen tokens from hosting infrastructure within minutes. Out of more than 200,000 login attempts, 97 accounts at 79 organizations were taken over and 48 rogue Entra devices were registered, followed by inbox-rule hiding and payroll / direct-deposit fraud. Ordinary MFA codes don't stop this, because the attacker reuses the session that was issued after MFA. Am I affected / how to check (Entra ID sign-in and audit logs, Exchange audit): - Successful sign-ins from 193.26.115.0/24 (1337 Services GmbH, AS210558), or from VPN and hosting providers your users don't use, especially to Microsoft Graph, Exchange Online or the Device Registration Service. - Sign-ins with a bare 'Mozilla/5.0' or 'node' user agent using Microsoft Office, Authentication Broker or OfficeHome client apps; AADSTS50133 (SsoArtifactRevoked) errors from those addresses. - Newly registered devices named DESKTOP- plus 8 hex characters that no one in IT recognizes, and new authenticator registrations (for example labelled 'iPhone 13') created minutes after an unusual sign-in. - Inbox rules with one-character or punctuation names that move mail to RSS Feeds or Conversation History, or filter words like payroll, bank, bonus or direct deposit. - New enterprise app consents you didn't approve. Contain an affected account: 1. Revoke all sessions and refresh tokens (Entra: Revoke sessions; or Revoke-MgUserSignInSession), then reset the password. A reset alone leaves issued tokens usable for a while. 2. Delete the rogue devices and any MFA methods the user didn't add, then have the user re-register. 3. Remove malicious inbox rules and forwarding, and check sent mail for fraudulent payment or bank-change requests; warn payroll and finance. 4. Revoke unwanted app consents. Harden: - Move high-value users to phishing-resistant MFA (passkeys / FIDO2, Windows Hello for Business), which AiTM relays can't capture. - Conditional Access: require compliant or hybrid-joined devices for access, block device-code flow except for named accounts that need it, require MFA to register devices and security info, and enable Token Protection (token binding) where supported. - Turn off user consent to apps (admin approval workflow) and alert on sign-ins from hosting ASNs and on new device registrations. Sources: https://www.huntress.com/blog/token-replay-spray https://thehackernews.com/2026/10/microsoft-365-token-replay-attacks.html